hammoc 1.0.0

package/packages/server/dist/utils/logger.js

@@ -0,0 +1,87 @@
+/**
+ * Server Logger — level-filtered logging with console + file output
+ *
+ * Usage:
+ *   import { createLogger } from '../utils/logger.js';
+ *   const log = createLogger('queueService');
+ *   log.info('START: items=5');
+ *   log.debug('executeLoop: ENTER');
+ *   log.error('UNEXPECTED:', err.message);
+ *
+ * Configuration:
+ *   LOG_LEVEL env var: ERROR | WARN | INFO | DEBUG | VERBOSE (default: DEBUG in dev, INFO in prod)
+ */
+import { appendFileSync, mkdirSync, existsSync } from 'fs';
+import path from 'path';
+import { LogLevel, parseLogLevel } from '@hammoc/shared';
+// Determine current log level from environment
+// Reads process.env directly (not from config/index.ts) to avoid circular dependency
+const envLevel = parseLogLevel(process.env.LOG_LEVEL);
+const isProduction = process.env.NODE_ENV === 'production';
+const currentLevel = envLevel ?? (isProduction ? LogLevel.INFO : LogLevel.DEBUG);
+// Ensure logs directory exists
+const logsDir = path.join(process.cwd(), 'logs');
+if (!existsSync(logsDir)) {
+    mkdirSync(logsDir, { recursive: true });
+}
+function getLogFile() {
+    const date = new Date().toISOString().split('T')[0];
+    return path.join(logsDir, `server-${date}.log`);
+}
+function formatForFile(levelName, module, message, args) {
+    const ts = new Date().toISOString();
+    const argsStr = args.length > 0
+        ? ' ' + args.map(a => (typeof a === 'string' ? a : JSON.stringify(a))).join(' ')
+        : '';
+    return `[${ts}] [${levelName}] [${module}] ${message}${argsStr}\n`;
+}
+const consoleMethods = {
+    [LogLevel.ERROR]: console.error,
+    [LogLevel.WARN]: console.warn,
+    [LogLevel.INFO]: console.log,
+    [LogLevel.DEBUG]: console.log,
+    [LogLevel.VERBOSE]: console.log,
+};
+const levelNames = {
+    [LogLevel.ERROR]: 'ERROR',
+    [LogLevel.WARN]: 'WARN',
+    [LogLevel.INFO]: 'INFO',
+    [LogLevel.DEBUG]: 'DEBUG',
+    [LogLevel.VERBOSE]: 'VERBOSE',
+};
+function writeLog(level, module, message, ...args) {
+    if (level > currentLevel)
+        return;
+    // Console output
+    const prefix = `[${module}]`;
+    if (args.length > 0) {
+        consoleMethods[level](`${prefix} ${message}`, ...args);
+    }
+    else {
+        consoleMethods[level](`${prefix} ${message}`);
+    }
+    // File output
+    try {
+        appendFileSync(getLogFile(), formatForFile(levelNames[level], module, message, args), 'utf-8');
+    }
+    catch {
+        // Silent — logging should never crash the app
+    }
+}
+/**
+ * Create a module-scoped logger instance.
+ */
+export function createLogger(module) {
+    return {
+        error: (message, ...args) => writeLog(LogLevel.ERROR, module, message, ...args),
+        warn: (message, ...args) => writeLog(LogLevel.WARN, module, message, ...args),
+        info: (message, ...args) => writeLog(LogLevel.INFO, module, message, ...args),
+        debug: (message, ...args) => writeLog(LogLevel.DEBUG, module, message, ...args),
+        verbose: (message, ...args) => writeLog(LogLevel.VERBOSE, module, message, ...args),
+    };
+}
+/** Get current effective log level (for display/diagnostics) */
+export function getEffectiveLogLevel() {
+    return currentLevel;
+}
+//# sourceMappingURL=logger.js.map

package/packages/server/dist/utils/logger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.js","sourceRoot":"","sources":["../../src/utils/logger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAC3D,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAEzD,+CAA+C;AAC/C,qFAAqF;AACrF,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;AACtD,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;AAC3D,MAAM,YAAY,GAAa,QAAQ,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAE3F,+BAA+B;AAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;AACjD,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;IACzB,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,UAAU;IACjB,MAAM,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACpD,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,IAAI,MAAM,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,aAAa,CAAC,SAAiB,EAAE,MAAc,EAAE,OAAe,EAAE,IAAe;IACxF,MAAM,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACpC,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC;QAC7B,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QAChF,CAAC,CAAC,EAAE,CAAC;IACP,OAAO,IAAI,EAAE,MAAM,SAAS,MAAM,MAAM,KAAK,OAAO,GAAG,OAAO,IAAI,CAAC;AACrE,CAAC;AAED,MAAM,cAAc,GAAiD;IACnE,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,KAAK;IAC/B,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,IAAI;IAC7B,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,GAAG;IAC5B,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,GAAG;IAC7B,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,GAAG;CAChC,CAAC;AAEF,MAAM,UAAU,GAA2B;IACzC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO;IACzB,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM;IACvB,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM;IACvB,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO;IACzB,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS;CAC9B,CAAC;AAEF,SAAS,QAAQ,CAAC,KAAe,EAAE,MAAc,EAAE,OAAe,EAAE,GAAG,IAAe;IACpF,IAAI,KAAK,GAAG,YAAY;QAAE,OAAO;IAEjC,iBAAiB;IACjB,MAAM,MAAM,GAAG,IAAI,MAAM,GAAG,CAAC;IAC7B,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpB,cAAc,CAAC,KAAK,CAAC,CAAC,GAAG,MAAM,IAAI,OAAO,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC;IACzD,CAAC;SAAM,CAAC;QACN,cAAc,CAAC,KAAK,CAAC,CAAC,GAAG,MAAM,IAAI,OAAO,EAAE,CAAC,CAAC;IAChD,CAAC;IAED,cAAc;IACd,IAAI,CAAC;QACH,cAAc,CAAC,UAAU,EAAE,EAAE,aAAa,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;IACjG,CAAC;IAAC,MAAM,CAAC;QACP,8CAA8C;IAChD,CAAC;AACH,CAAC;AAUD;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,MAAc;IACzC,OAAO;QACL,KAAK,EAAE,CAAC,OAAe,EAAE,GAAG,IAAe,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;QAClG,IAAI,EAAE,CAAC,OAAe,EAAE,GAAG,IAAe,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;QAChG,IAAI,EAAE,CAAC,OAAe,EAAE,GAAG,IAAe,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;QAChG,KAAK,EAAE,CAAC,OAAe,EAAE,GAAG,IAAe,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;QAClG,OAAO,EAAE,CAAC,OAAe,EAAE,GAAG,IAAe,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;KACvG,CAAC;AACJ,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,oBAAoB;IAClC,OAAO,YAAY,CAAC;AACtB,CAAC"}

package/packages/server/dist/utils/networkUtils.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Network Utilities for Terminal Security
+ * Story 17.5: Terminal Security - IP-based access control
+ */
+import type { Socket } from 'socket.io';
+/**
+ * Check if an IP address belongs to a local/private network range.
+ * Supports IPv4, IPv6 loopback, and IPv4-mapped IPv6 addresses.
+ *
+ * Local ranges:
+ *   127.0.0.0/8, ::1, 10.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12
+ *   ::ffff:<ipv4> variants of the above
+ */
+export declare function isLocalIP(ip: string): boolean;
+/**
+ * Extract client IP address from a Socket.io socket.
+ * Uses socket.handshake.address directly.
+ * X-Forwarded-For and other proxy headers are intentionally ignored for security.
+ */
+export declare function extractClientIP(socket: Socket): string;
+/**
+ * Check if the server binding address is an external interface.
+ * Returns true for 0.0.0.0, ::, or non-loopback/non-localhost addresses.
+ */
+export declare function isExternalBinding(host: string): boolean;
+//# sourceMappingURL=networkUtils.d.ts.map

package/packages/server/dist/utils/networkUtils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"networkUtils.d.ts","sourceRoot":"","sources":["../../src/utils/networkUtils.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAExC;;;;;;;GAOG;AACH,wBAAgB,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAkC7C;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAWvD"}

package/packages/server/dist/utils/networkUtils.js

@@ -0,0 +1,70 @@
+/**
+ * Network Utilities for Terminal Security
+ * Story 17.5: Terminal Security - IP-based access control
+ */
+/**
+ * Check if an IP address belongs to a local/private network range.
+ * Supports IPv4, IPv6 loopback, and IPv4-mapped IPv6 addresses.
+ *
+ * Local ranges:
+ *   127.0.0.0/8, ::1, 10.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12
+ *   ::ffff:<ipv4> variants of the above
+ */
+export function isLocalIP(ip) {
+    if (!ip || typeof ip !== 'string')
+        return false;
+    // IPv6 loopback
+    if (ip === '::1')
+        return true;
+    // Strip IPv4-mapped IPv6 prefix (::ffff:x.x.x.x)
+    let normalizedIP = ip;
+    if (normalizedIP.startsWith('::ffff:')) {
+        normalizedIP = normalizedIP.slice(7);
+    }
+    // Parse IPv4
+    const parts = normalizedIP.split('.');
+    if (parts.length !== 4)
+        return false;
+    const octets = parts.map((p) => parseInt(p, 10));
+    if (octets.some((o) => isNaN(o) || o < 0 || o > 255))
+        return false;
+    const [a, b] = octets;
+    // 127.0.0.0/8 (loopback)
+    if (a === 127)
+        return true;
+    // 10.0.0.0/8 (private)
+    if (a === 10)
+        return true;
+    // 192.168.0.0/16 (private)
+    if (a === 192 && b === 168)
+        return true;
+    // 172.16.0.0/12 (172.16.x.x ~ 172.31.x.x)
+    if (a === 172 && b >= 16 && b <= 31)
+        return true;
+    return false;
+}
+/**
+ * Extract client IP address from a Socket.io socket.
+ * Uses socket.handshake.address directly.
+ * X-Forwarded-For and other proxy headers are intentionally ignored for security.
+ */
+export function extractClientIP(socket) {
+    return socket.handshake.address || '';
+}
+/**
+ * Check if the server binding address is an external interface.
+ * Returns true for 0.0.0.0, ::, or non-loopback/non-localhost addresses.
+ */
+export function isExternalBinding(host) {
+    if (!host)
+        return false;
+    // Wildcard bindings — listen on all interfaces
+    if (host === '0.0.0.0' || host === '::')
+        return true;
+    // Loopback addresses and localhost are not external
+    if (host === 'localhost' || host === '127.0.0.1' || host === '::1')
+        return false;
+    // Anything else (e.g. 192.168.1.100) is an external interface
+    return true;
+}
+//# sourceMappingURL=networkUtils.js.map

package/packages/server/dist/utils/networkUtils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"networkUtils.js","sourceRoot":"","sources":["../../src/utils/networkUtils.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH;;;;;;;GAOG;AACH,MAAM,UAAU,SAAS,CAAC,EAAU;IAClC,IAAI,CAAC,EAAE,IAAI,OAAO,EAAE,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAEhD,gBAAgB;IAChB,IAAI,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAE9B,iDAAiD;IACjD,IAAI,YAAY,GAAG,EAAE,CAAC;IACtB,IAAI,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACvC,YAAY,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACvC,CAAC;IAED,aAAa;IACb,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAErC,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IACjD,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAEnE,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC;IAEtB,yBAAyB;IACzB,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAE3B,uBAAuB;IACvB,IAAI,CAAC,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAE1B,2BAA2B;IAC3B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAExC,0CAA0C;IAC1C,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC;IAEjD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,MAAc;IAC5C,OAAO,MAAM,CAAC,SAAS,CAAC,OAAO,IAAI,EAAE,CAAC;AACxC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IAExB,+CAA+C;IAC/C,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAErD,oDAAoD;IACpD,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IAEjF,8DAA8D;IAC9D,OAAO,IAAI,CAAC;AACd,CAAC"}

package/packages/server/dist/utils/pathUtils.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Path Utilities
+ * Binary file detection, MIME type mapping, file size constants, and protected path validation.
+ * [Source: Story 11.1 - Task 3, Story 11.2 - Task 2]
+ */
+/** Directories protected from deletion without force flag */
+export declare const PROTECTED_DIRECTORIES: readonly [".git", "node_modules", ".bmad-core"];
+/**
+ * Checks if the given relative path is under a protected directory.
+ * Protected directories require force=true for deletion.
+ * @param relativePath Relative path to check
+ * @returns true if the path is under a protected directory
+ */
+export declare function isProtectedPath(relativePath: string): boolean;
+/** Maximum file size for full content response (1MB) */
+export declare const MAX_FILE_SIZE: number;
+/**
+ * Detect if a file is binary by reading the first 8192 bytes
+ * and checking for null byte presence.
+ * @param filePath Absolute path to the file
+ * @returns true if the file appears to be binary
+ */
+export declare function isBinaryFile(filePath: string): Promise<boolean>;
+/**
+ * Get MIME type based on file extension.
+ * @param filePath File path (only extension is used)
+ * @returns MIME type string
+ */
+export declare function getMimeType(filePath: string): string;
+//# sourceMappingURL=pathUtils.d.ts.map

package/packages/server/dist/utils/pathUtils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pathUtils.d.ts","sourceRoot":"","sources":["../../src/utils/pathUtils.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,6DAA6D;AAC7D,eAAO,MAAM,qBAAqB,iDAAkD,CAAC;AAErF;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAI7D;AAED,wDAAwD;AACxD,eAAO,MAAM,aAAa,QAAkB,CAAC;AAK7C;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAiBrE;AA2BD;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAGpD"}

package/packages/server/dist/utils/pathUtils.js

@@ -0,0 +1,81 @@
+/**
+ * Path Utilities
+ * Binary file detection, MIME type mapping, file size constants, and protected path validation.
+ * [Source: Story 11.1 - Task 3, Story 11.2 - Task 2]
+ */
+import fs from 'fs/promises';
+import path from 'path';
+/** Directories protected from deletion without force flag */
+export const PROTECTED_DIRECTORIES = ['.git', 'node_modules', '.bmad-core'];
+/**
+ * Checks if the given relative path is under a protected directory.
+ * Protected directories require force=true for deletion.
+ * @param relativePath Relative path to check
+ * @returns true if the path is under a protected directory
+ */
+export function isProtectedPath(relativePath) {
+    const normalized = path.normalize(relativePath);
+    const firstSegment = normalized.split(path.sep)[0];
+    return PROTECTED_DIRECTORIES.includes(firstSegment);
+}
+/** Maximum file size for full content response (1MB) */
+export const MAX_FILE_SIZE = 1 * 1024 * 1024;
+/** Number of bytes to read for binary detection */
+const BINARY_CHECK_BYTES = 8192;
+/**
+ * Detect if a file is binary by reading the first 8192 bytes
+ * and checking for null byte presence.
+ * @param filePath Absolute path to the file
+ * @returns true if the file appears to be binary
+ */
+export async function isBinaryFile(filePath) {
+    const handle = await fs.open(filePath, 'r');
+    try {
+        const buffer = Buffer.alloc(BINARY_CHECK_BYTES);
+        const { bytesRead } = await handle.read(buffer, 0, BINARY_CHECK_BYTES, 0);
+        // Check for null bytes in the read portion
+        for (let i = 0; i < bytesRead; i++) {
+            if (buffer[i] === 0) {
+                return true;
+            }
+        }
+        return false;
+    }
+    finally {
+        await handle.close();
+    }
+}
+/** Extension to MIME type mapping */
+const MIME_MAP = {
+    '.ts': 'text/typescript',
+    '.tsx': 'text/typescript',
+    '.js': 'text/javascript',
+    '.jsx': 'text/javascript',
+    '.json': 'application/json',
+    '.md': 'text/markdown',
+    '.html': 'text/html',
+    '.htm': 'text/html',
+    '.css': 'text/css',
+    '.yaml': 'text/yaml',
+    '.yml': 'text/yaml',
+    '.py': 'text/x-python',
+    '.png': 'image/png',
+    '.jpg': 'image/jpeg',
+    '.jpeg': 'image/jpeg',
+    '.gif': 'image/gif',
+    '.svg': 'image/svg+xml',
+    '.xml': 'application/xml',
+    '.txt': 'text/plain',
+    '.sh': 'text/x-shellscript',
+    '.env': 'text/plain',
+};
+/**
+ * Get MIME type based on file extension.
+ * @param filePath File path (only extension is used)
+ * @returns MIME type string
+ */
+export function getMimeType(filePath) {
+    const ext = path.extname(filePath).toLowerCase();
+    return MIME_MAP[ext] || 'application/octet-stream';
+}
+//# sourceMappingURL=pathUtils.js.map

package/packages/server/dist/utils/pathUtils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pathUtils.js","sourceRoot":"","sources":["../../src/utils/pathUtils.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,MAAM,aAAa,CAAC;AAC7B,OAAO,IAAI,MAAM,MAAM,CAAC;AAExB,6DAA6D;AAC7D,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,MAAM,EAAE,cAAc,EAAE,YAAY,CAAU,CAAC;AAErF;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,YAAoB;IAClD,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;IAChD,MAAM,YAAY,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACnD,OAAO,qBAAqB,CAAC,QAAQ,CAAC,YAAoD,CAAC,CAAC;AAC9F,CAAC;AAED,wDAAwD;AACxD,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAE7C,mDAAmD;AACnD,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAEhC;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,QAAgB;IACjD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC5C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;QAChD,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC;QAE1E,2CAA2C;QAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC;YACnC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;gBACpB,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAED,qCAAqC;AACrC,MAAM,QAAQ,GAA2B;IACvC,KAAK,EAAE,iBAAiB;IACxB,MAAM,EAAE,iBAAiB;IACzB,KAAK,EAAE,iBAAiB;IACxB,MAAM,EAAE,iBAAiB;IACzB,OAAO,EAAE,kBAAkB;IAC3B,KAAK,EAAE,eAAe;IACtB,OAAO,EAAE,WAAW;IACpB,MAAM,EAAE,WAAW;IACnB,MAAM,EAAE,UAAU;IAClB,OAAO,EAAE,WAAW;IACpB,MAAM,EAAE,WAAW;IACnB,KAAK,EAAE,eAAe;IACtB,MAAM,EAAE,WAAW;IACnB,MAAM,EAAE,YAAY;IACpB,OAAO,EAAE,YAAY;IACrB,MAAM,EAAE,WAAW;IACnB,MAAM,EAAE,eAAe;IACvB,MAAM,EAAE,iBAAiB;IACzB,MAAM,EAAE,YAAY;IACpB,KAAK,EAAE,oBAAoB;IAC3B,MAAM,EAAE,YAAY;CACrB,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,QAAgB;IAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;IACjD,OAAO,QAAQ,CAAC,GAAG,CAAC,IAAI,0BAA0B,CAAC;AACrD,CAAC"}

package/packages/server/package.json

@@ -0,0 +1,48 @@
+{
+  "name": "@hammoc/server",
+  "version": "1.0.0",
+  "type": "module",
+  "main": "dist/index.js",
+  "scripts": {
+    "dev": "node --import tsx/esm --watch src/dev.ts",
+    "build": "tsc && node -e \"require('fs').cpSync('src/locales','dist/locales',{recursive:true})\"",
+    "start": "cross-env NODE_ENV=production node dist/index.js",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run --exclude '**/**.integration.test.ts'",
+    "test:watch": "vitest --exclude '**/**.integration.test.ts'",
+    "test:coverage": "vitest run --coverage --exclude '**/**.integration.test.ts'",
+    "test:integration": "vitest run src/services/__tests__/chatService.integration.test.ts",
+    "test:all": "vitest run"
+  },
+  "dependencies": {
+    "@anthropic-ai/claude-agent-sdk": "^0.2.34",
+    "@hammoc/shared": "*",
+    "bcrypt": "^6.0.0",
+    "cookie-session": "^2.1.1",
+    "cors": "^2.8.5",
+    "express": "^4.21.0",
+    "i18next": "^24.2.3",
+    "js-yaml": "^4.1.1",
+    "multer": "^2.1.1",
+    "node-pty": "^1.0.0",
+    "simple-git": "^3.27.0",
+    "socket.io": "^4.8.0",
+    "zod": "^4.3.6"
+  },
+  "devDependencies": {
+    "@types/bcrypt": "^6.0.0",
+    "@types/cookie-session": "^2.0.49",
+    "@types/cors": "^2.8.19",
+    "@types/express": "^4.17.25",
+    "@types/express-serve-static-core": "^4.19.8",
+    "@types/js-yaml": "^4.0.9",
+    "@types/multer": "^2.1.0",
+    "@types/node": "^22.0.0",
+    "@types/supertest": "^6.0.3",
+    "@vitest/coverage-v8": "^2.0.0",
+    "supertest": "^7.2.2",
+    "tsx": "^4.19.0",
+    "typescript": "^5.6.0",
+    "vitest": "^2.0.0"
+  }
+}

package/packages/shared/dist/constants/errorCodes.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Standard Error Codes
+ * Story 1.5: End-to-End Test Page
+ */
+/**
+ * Standard error codes for WebSocket communication
+ */
+export declare const ERROR_CODES: {
+    /** General chat processing error */
+    readonly CHAT_ERROR: "CHAT_ERROR";
+    /** Claude Code CLI connection failure */
+    readonly SDK_CONNECTION_ERROR: "SDK_CONNECTION_ERROR";
+    /** SDK response timeout */
+    readonly SDK_TIMEOUT: "SDK_TIMEOUT";
+    /** Invalid working directory */
+    readonly INVALID_WORKING_DIR: "INVALID_WORKING_DIR";
+    /** Session not found */
+    readonly SESSION_NOT_FOUND: "SESSION_NOT_FOUND";
+    /** Network connection issue */
+    readonly NETWORK_ERROR: "NETWORK_ERROR";
+    /** JSONL parsing failure */
+    readonly SESSION_PARSE_ERROR: "SESSION_PARSE_ERROR";
+    /** Invalid path parameter (path traversal attempt) */
+    readonly INVALID_PATH: "INVALID_PATH";
+    /** Chat response timeout */
+    readonly TIMEOUT_ERROR: "TIMEOUT_ERROR";
+    /** Input validation error (e.g., invalid image) */
+    readonly VALIDATION_ERROR: "VALIDATION_ERROR";
+};
+export type ErrorCode = (typeof ERROR_CODES)[keyof typeof ERROR_CODES];
+//# sourceMappingURL=errorCodes.d.ts.map

package/packages/shared/dist/constants/errorCodes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errorCodes.d.ts","sourceRoot":"","sources":["../../src/constants/errorCodes.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AACH,eAAO,MAAM,WAAW;IACtB,oCAAoC;;IAEpC,yCAAyC;;IAEzC,2BAA2B;;IAE3B,gCAAgC;;IAEhC,wBAAwB;;IAExB,+BAA+B;;IAG/B,4BAA4B;;IAE5B,sDAAsD;;IAGtD,4BAA4B;;IAG5B,mDAAmD;;CAE3C,CAAC;AAEX,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,OAAO,WAAW,CAAC,CAAC"}

package/packages/shared/dist/constants/errorCodes.js

@@ -0,0 +1,33 @@
+/**
+ * Standard Error Codes
+ * Story 1.5: End-to-End Test Page
+ */
+/**
+ * Standard error codes for WebSocket communication
+ */
+export const ERROR_CODES = {
+    /** General chat processing error */
+    CHAT_ERROR: 'CHAT_ERROR',
+    /** Claude Code CLI connection failure */
+    SDK_CONNECTION_ERROR: 'SDK_CONNECTION_ERROR',
+    /** SDK response timeout */
+    SDK_TIMEOUT: 'SDK_TIMEOUT',
+    /** Invalid working directory */
+    INVALID_WORKING_DIR: 'INVALID_WORKING_DIR',
+    /** Session not found */
+    SESSION_NOT_FOUND: 'SESSION_NOT_FOUND',
+    /** Network connection issue */
+    NETWORK_ERROR: 'NETWORK_ERROR',
+    // Story 3.5: Session History Loading error codes
+    /** JSONL parsing failure */
+    SESSION_PARSE_ERROR: 'SESSION_PARSE_ERROR',
+    /** Invalid path parameter (path traversal attempt) */
+    INVALID_PATH: 'INVALID_PATH',
+    // Story 4.6: Timeout error code
+    /** Chat response timeout */
+    TIMEOUT_ERROR: 'TIMEOUT_ERROR',
+    // Story 5.5: Image Attachment validation
+    /** Input validation error (e.g., invalid image) */
+    VALIDATION_ERROR: 'VALIDATION_ERROR',
+};
+//# sourceMappingURL=errorCodes.js.map

package/packages/shared/dist/constants/errorCodes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errorCodes.js","sourceRoot":"","sources":["../../src/constants/errorCodes.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,oCAAoC;IACpC,UAAU,EAAE,YAAY;IACxB,yCAAyC;IACzC,oBAAoB,EAAE,sBAAsB;IAC5C,2BAA2B;IAC3B,WAAW,EAAE,aAAa;IAC1B,gCAAgC;IAChC,mBAAmB,EAAE,qBAAqB;IAC1C,wBAAwB;IACxB,iBAAiB,EAAE,mBAAmB;IACtC,+BAA+B;IAC/B,aAAa,EAAE,eAAe;IAC9B,iDAAiD;IACjD,4BAA4B;IAC5B,mBAAmB,EAAE,qBAAqB;IAC1C,sDAAsD;IACtD,YAAY,EAAE,cAAc;IAC5B,gCAAgC;IAChC,4BAA4B;IAC5B,aAAa,EAAE,eAAe;IAC9B,yCAAyC;IACzC,mDAAmD;IACnD,gBAAgB,EAAE,kBAAkB;CAC5B,CAAC"}

package/packages/shared/dist/index.d.ts

@@ -0,0 +1,26 @@
+export * from './types/sdk.js';
+export * from './types/streaming.js';
+export * from './types/websocket.js';
+export * from './types/message.js';
+export * from './constants/errorCodes.js';
+export * from './types/session.js';
+export * from './types/cli.js';
+export { AuthConfig, PasswordValidationResult, MIN_PASSWORD_LENGTH, AuthConfigError, } from './types/auth.js';
+export { LoginRequest, LoginResponse, RateLimitInfo, RateLimitErrorResponse, LOGIN_ERRORS, } from './types/auth.js';
+export { LogoutResponse, AuthStatus, AUTH_ERROR_CODES, SetupPasswordRequest, SetupPasswordResponse, } from './types/auth.js';
+export { AUTH_ERROR_MESSAGES } from './types/auth.js';
+export { ProjectInfo, ProjectListResponse, PROJECT_ERRORS, CreateProjectRequest, CreateProjectResponse, DeleteProjectResponse, ValidatePathRequest, ValidatePathResponse, BmadVersionsResponse, ProjectSettings, UpdateProjectSettingsRequest, ProjectSettingsApiResponse, SetupBmadRequest, SetupBmadResponse, } from './types/project.js';
+export { SlashCommand, StarCommand, CommandsResponse } from './types/command.js';
+export { UserPreferences, PromptHistoryData, DEFAULT_PREFERENCES, PreferencesApiResponse, TelegramSettings, TelegramSettingsApiResponse, UpdateTelegramSettingsRequest, SupportedLanguage, SUPPORTED_LANGUAGES, } from './types/preferences.js';
+export { RawJSONLMessage, HistoryMessage, PaginationInfo, HistoryMessagesResponse, PaginationOptions, ContentBlock, TextContentBlock, ThinkingContentBlock, ToolUseContentBlock, ToolResultContentBlock, ImageContentBlock, } from './types/history.js';
+export * from './types/fileSystem.js';
+export * from './types/bmadStatus.js';
+export * from './types/queue.js';
+export { parseQueueScript } from './utils/queueParser.js';
+export { extractStoryNumbers, generateQueueFromTemplate } from './utils/queueTemplateUtils.js';
+export * from './types/git.js';
+export * from './types/terminal.js';
+export * from './types/dashboard.js';
+export * from './types/board.js';
+export { LogLevel, parseLogLevel } from './types/logger.js';
+//# sourceMappingURL=index.d.ts.map

package/packages/shared/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,cAAc,gBAAgB,CAAC;AAG/B,cAAc,sBAAsB,CAAC;AAGrC,cAAc,sBAAsB,CAAC;AAGrC,cAAc,oBAAoB,CAAC;AACnC,cAAc,2BAA2B,CAAC;AAI1C,cAAc,oBAAoB,CAAC;AAGnC,cAAc,gBAAgB,CAAC;AAG/B,OAAO,EACL,UAAU,EACV,wBAAwB,EACxB,mBAAmB,EACnB,eAAe,GAChB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,YAAY,EACZ,aAAa,EACb,aAAa,EACb,sBAAsB,EACtB,YAAY,GACb,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,cAAc,EACd,UAAU,EACV,gBAAgB,EAChB,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAItD,OAAO,EACL,WAAW,EACX,mBAAmB,EACnB,cAAc,EACd,oBAAoB,EACpB,qBAAqB,EACrB,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EACpB,oBAAoB,EACpB,eAAe,EACf,4BAA4B,EAC5B,0BAA0B,EAC1B,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAI5B,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAGjF,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,mBAAmB,EACnB,sBAAsB,EACtB,gBAAgB,EAChB,2BAA2B,EAC3B,6BAA6B,EAC7B,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EACL,eAAe,EACf,cAAc,EACd,cAAc,EACd,uBAAuB,EACvB,iBAAiB,EACjB,YAAY,EACZ,gBAAgB,EAChB,oBAAoB,EACpB,mBAAmB,EACnB,sBAAsB,EACtB,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAG5B,cAAc,uBAAuB,CAAC;AAGtC,cAAc,uBAAuB,CAAC;AAGtC,cAAc,kBAAkB,CAAC;AAGjC,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAG1D,OAAO,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,+BAA+B,CAAC;AAG/F,cAAc,gBAAgB,CAAC;AAG/B,cAAc,qBAAqB,CAAC;AAGpC,cAAc,sBAAsB,CAAC;AAGrC,cAAc,kBAAkB,CAAC;AAGjC,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC"}

package/packages/shared/dist/index.js

@@ -0,0 +1,48 @@
+// Story 1.2: SDK types for ChatService
+export * from './types/sdk.js';
+// Story 1.3: Streaming types for StreamHandler
+export * from './types/streaming.js';
+// Story 1.4: WebSocket types for Socket.io
+export * from './types/websocket.js';
+// Story 5.5: Attachment, ImageAttachment, IMAGE_CONSTRAINTS
+export * from './types/message.js';
+export * from './constants/errorCodes.js';
+// Story 1.6: Session types for session management
+// Story 3.3: Session List API types (SessionListItem, SessionListResponse, SESSION_ERRORS)
+export * from './types/session.js';
+// Story 1.7: CLI status types for CLI Status API
+export * from './types/cli.js';
+// Story 2.1: Auth types for Password Configuration
+export { MIN_PASSWORD_LENGTH, AuthConfigError, } from './types/auth.js';
+// Story 2.2: Login types
+export { LOGIN_ERRORS, } from './types/auth.js';
+// Story 2.4: Logout types and error codes
+export { AUTH_ERROR_CODES, } from './types/auth.js';
+// Story 2.5: Auth error messages
+export { AUTH_ERROR_MESSAGES } from './types/auth.js';
+// Story 3.1: Project types for Project List API
+// Story 3.6: Extended with project creation types
+export { PROJECT_ERRORS, } from './types/project.js';
+// User Preferences types (server-side settings)
+export { DEFAULT_PREFERENCES, SUPPORTED_LANGUAGES, } from './types/preferences.js';
+// Story 11.1: File System types for file read and directory list API
+export * from './types/fileSystem.js';
+// Story 12.1: BMad Status types for BMad Dashboard API
+export * from './types/bmadStatus.js';
+// Story 15.1: Queue Runner types
+export * from './types/queue.js';
+// Story 15.1: Queue script parser
+export { parseQueueScript } from './utils/queueParser.js';
+// Story 15.5: Queue template utilities
+export { extractStoryNumbers, generateQueueFromTemplate } from './utils/queueTemplateUtils.js';
+// Story 16.1: Git types (Epic 16)
+export * from './types/git.js';
+// Story 17.1: Terminal PTY types (Epic 17)
+export * from './types/terminal.js';
+// Story 20.1: Dashboard types
+export * from './types/dashboard.js';
+// Story 21.1: Board types (Epic 21)
+export * from './types/board.js';
+// Logger types (shared between server and client)
+export { LogLevel, parseLogLevel } from './types/logger.js';
+//# sourceMappingURL=index.js.map

package/packages/shared/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,cAAc,gBAAgB,CAAC;AAE/B,+CAA+C;AAC/C,cAAc,sBAAsB,CAAC;AAErC,2CAA2C;AAC3C,cAAc,sBAAsB,CAAC;AAErC,4DAA4D;AAC5D,cAAc,oBAAoB,CAAC;AACnC,cAAc,2BAA2B,CAAC;AAE1C,kDAAkD;AAClD,2FAA2F;AAC3F,cAAc,oBAAoB,CAAC;AAEnC,iDAAiD;AACjD,cAAc,gBAAgB,CAAC;AAE/B,mDAAmD;AACnD,OAAO,EAGL,mBAAmB,EACnB,eAAe,GAChB,MAAM,iBAAiB,CAAC;AAEzB,yBAAyB;AACzB,OAAO,EAKL,YAAY,GACb,MAAM,iBAAiB,CAAC;AAEzB,0CAA0C;AAC1C,OAAO,EAGL,gBAAgB,GAGjB,MAAM,iBAAiB,CAAC;AAEzB,iCAAiC;AACjC,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAEtD,gDAAgD;AAChD,kDAAkD;AAClD,OAAO,EAGL,cAAc,GAYf,MAAM,oBAAoB,CAAC;AAM5B,gDAAgD;AAChD,OAAO,EAGL,mBAAmB,EAMnB,mBAAmB,GACpB,MAAM,wBAAwB,CAAC;AAiBhC,qEAAqE;AACrE,cAAc,uBAAuB,CAAC;AAEtC,uDAAuD;AACvD,cAAc,uBAAuB,CAAC;AAEtC,iCAAiC;AACjC,cAAc,kBAAkB,CAAC;AAEjC,kCAAkC;AAClC,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE1D,uCAAuC;AACvC,OAAO,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,+BAA+B,CAAC;AAE/F,kCAAkC;AAClC,cAAc,gBAAgB,CAAC;AAE/B,2CAA2C;AAC3C,cAAc,qBAAqB,CAAC;AAEpC,8BAA8B;AAC9B,cAAc,sBAAsB,CAAC;AAErC,oCAAoC;AACpC,cAAc,kBAAkB,CAAC;AAEjC,kDAAkD;AAClD,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC"}